Data Breach Notification Leads (HHS, State AG & SEC 8-K)

Get organizations that just reported a data breach to a regulator, from four official public sources, merged into one row per organization:

• HHS OCR HIPAA Breach Portal: healthcare providers, health plans and business associates with a breach of 500+ people (US-wide, with people affected, breach type and where the data was)
• California Attorney General data breach list: every industry, with breach dates, notice page and (optional) the consumer notice letter PDF
• Washington Attorney General data breach notifications: 500+ WA residents, with people affected, cause, industry, data types exposed (SSN, medical, financial, driver's license...) and days to notify
• SEC 8-K cybersecurity disclosures (Item 1.05 material incidents and Item 8.01 voluntary disclosures): public companies, with ticker, phone and business address from SEC EDGAR

No API key, no login, no proxies. Only organization-level notices are returned: no data about the people affected.

Why merged rows matter

The same breach often shows up with several regulators under slightly different names. This actor matches them (ignoring Inc/LLC/Corp and punctuation), so you get one row with every notice, the largest reported count, all breach dates and links. In a 2-year test run (2026-10-21): 2,395 notices → 1,827 organizations, 308 of them filed with 2+ regulators.

How fresh is it

Checked on 2026-10-21: California's list ran through 2026-10-19 (57 notices in the last 30 days), HHS OCR through 2026-10-01 (765 open reports covering the last 24 months), SEC EDGAR is same-day, and Washington's dataset ran through 2026-09-11 (it updates in batches). Use 30 to 90 days back for a good mix.

What you get per organization

• Organization name, sources, number of notices, newest and oldest notice date
• People affected (HHS and/or Washington), breach dates, breach type / cause, where the data was (network server, email, paper...), data types exposed, business associate involved, industry, state, days to notify
• Public companies: tickers, CIK, phone, website, business address, SEC filing link
• Links to every notice (HHS portal, California notice page, Washington dataset, SEC filing), plus per-source notice details
• Optional: California consumer notice letter PDF links

Who uses it

• Cybersecurity vendors and incident response / MSSP teams: organizations that just had a breach (filter by hacking, ransomware, email)
• Cyber insurance agents and underwriters: fresh loss events by industry, state and size
• Data breach and privacy law firms: new breaches with counts, data types and notice letters
• Healthcare compliance and HIPAA consultants: providers and business associates on the HHS list
• Identity protection, credit monitoring and PR/crisis firms: organizations sending notices right now
• Researchers, journalists and investors: breach trends; SEC 8-K material incidents by ticker

Filters

Sources, days back or start/end date, minimum people affected, organization state, industry keywords (e.g. Healthcare Provider, Business Associate, Finance), breach type keywords (e.g. hacking, ransomware, email), organization name keywords, SEC 8-K items (1.05 / 8.01), only organizations in 2+ sources, California notice letter PDFs on/off, max rows.

Example input

{
  "sources": ["hhs", "wa"],
  "daysBack": 180,
  "breachTypeKeywords": ["hacking", "ransomware", "malware"],
  "minIndividualsAffected": 10000,
  "maxResults": 50
}

Example output (trimmed)

{
  "organizationName": "Ridgeway Pharmacy, Ltd",
  "sources": ["California Attorney General", "HHS OCR HIPAA Breach Portal"],
  "sourceCount": 2,
  "latestReportedDate": "2026-09-21",
  "individualsAffected": 258920,
  "breachDates": ["2026-06-07"],
  "breachTypes": ["Hacking/IT Incident"],
  "breachedInformationLocation": "Network Server, Other",
  "businessAssociateInvolved": true,
  "industry": "Healthcare Provider",
  "entityState": "MT",
  "noticeUrls": ["https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf", "https://oag.ca.gov/ecrime/databreach/reports/sb24-630056"]
}

Pricing

Pay per result: $0.01 per organization ($10 per 1,000) plus a tiny actor-start fee. A 30-day all-source run is about 70 to 80 organizations.

Notes

• California and SEC notices don't publish people-affected counts, so minIndividualsAffected above 0 keeps only HHS and Washington rows.
• California's robots.txt asks for 10 seconds between requests; the actor follows it (about 10 s per 50 notices, plus 10 s per notice letter when enabled).
• SEC 8.01 rows are voluntary disclosures where the main 8-K document mentions a cybersecurity incident; Item 1.05 rows are formal material-incident filings.
• Data comes from official government sources (HHS OCR, California DOJ, Washington AGO via data.wa.gov, SEC EDGAR). Check the linked notice before acting on any row.